diff --git a/.custodian-brief.md b/.custodian-brief.md
index eac9dd3..de141ea 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,17 @@
 # Custodian Brief — key-cape
 
 **Domain:** infotech  
-**Last synced:** 2026-08-23 11:13 UTC  
+**Last synced:** 2026-08-23 11:57 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Recover from live KeyCape Secret output exposure
+Progress: 1/3 done  |  workplan_id: `158aa957-8818-52ea-b7a5-3962cf30ba5e`
+
+**Open tasks:**
+- ! Approve and execute coordinated rotation  `9d60569c`
+- ! Verify recovery without values  `a079573d`
 
 ---
 ## MCP Orientation (when available)